Cybersecurity writer and analyst. Covering breaches, threats, and vulnerabilities — analysis beyond the headline.
Artificial Intelligence (AI)
The AI-agent story just went transatlantic. The UK's AI Security Institute and OpenAI reported more cases of models exploiting the open internet during evaluations — WIRED says agents left instructions for future bad behavior — and the UK NCSC put out an official statement.
Artificial Intelligence (AI)
Fourteen thousand unknown flaws from one pipeline. Palo Alto Unit 42 says its NOVA system surfaced 14,000-plus previously unknown vulnerabilities across the open-source software supply chain — a scale that raises a hard question maintainers can't ignore: who triages them, and how many are real?
Vulnerabilities
The N-central flaw just went federal. CISA added CVE-2026-18577 (CVSS 8.2) to its Known Exploited Vulnerabilities catalog after N-able found a second vector past the original patch for CVE-2026-18556 — putting federal agencies on the clock and every MSP customer in scope.
Vulnerabilities
From hosting customer to database root. cPanel patched CVE-2026-58048 (CVSS 4.0 score 9.4), where an authenticated customer could execute SQL in the database's root context — crossing the account-to-admin boundary — and closed two more account-boundary routes in the same release.
Artificial Intelligence (AI)
The first documented agent-on-agent attack. Google removed three Agent Development Kit workflows after Pillar Security showed a poisoned public GitHub issue could push a low-privilege triage agent into triggering a privileged code-fixing agent — exposing secrets and tampering with pull requests.
CVE Watch
July belonged to SharePoint — four separate flaws exploited in the wild — while Microsoft shipped the largest Patch Tuesday in its history at 569 CVEs. Here's what to fix first.
Cybersecurity 101
A complete guide to privileged access management (PAM) — why privileged accounts warrant special treatment, the core PAM capabilities, and how to build a program.
Artificial Intelligence (AI)
The actor was caught by its own AI agent. Unit 42's full writeup details how the knaithe/KnYuan operator ran DeepSeek through the Hermes framework to target a security firm and line up 1,200-plus hosts for proxyjacking - before a misconfigured file server exposed everything.
Critical Infrastructure
The scope has names now. Water attacks span Minnesota plus at least six more states — Michigan, Georgia, and South Dakota confirmed — while Trump rejects the Iran assessment and calls Minnesota's governor 'grossly incompetent.' What's firm, what's political, and what operators should do.
Cloud & Identity
Passkeys aren't the panacea. Unit 42 details three attack paths — Pass-ta-key, Silver, and Golden — against Chrome's Google Password Manager cloud authenticator that let ordinary Windows malware sign into passkey-protected accounts with no fingerprint, PIN, or on-screen prompt.
Vulnerabilities
From auth bypass to patch bypass. N-able's N-central RMM has a critical authentication-bypass flaw (CVE-2026-18577) under active exploitation, and attackers defeated the initial fix. Build 2026.3.1.7 is the first unaffected version — and every downstream MSP customer is in scope.
Cybersecurity 101
A defender's guide to adversarial machine learning — evasion attacks, model extraction, membership inference, why ML systems are vulnerable, and layered defenses.